hansy

Yup that's about right. I don't mind though; I view this project as a labor of love.

Ha I appreciate the thought, but it's hard to compare novel writing from thought leaders to funny images. I wish I could charge more, but I don't think the value is quite there yet. Maybe if I was strict about exclusive content (which I don't want to be; I like giving artists flexibility on where/how they distribute their work), I could get away with charging higher as well.

Oof you're 100% right; definitely missed this.

Yup this is indeed a limitation in that once a code is used, the next person essentially has to wait at least one minute before they can get another working code.

My target is smaller teams, where collisions (hopefully) happen less frequently. If you're a bigger org, chances are you also have the resources to just buy everyone their own seat/license to the account instead of relying on the employees to share one account.

Using a separate device (yubikey, mobile phone, etc) is always recommended, but this is a bit more secure than meets the eye. Someone would have to get access to your Slack account to view the codes, and to do that, they'd have to first get access to your work email (because Slack is password-less and emails auth links to you).

At the moment I don't log/track anything (I don't even store user emails), but I can see an audit trail being extremely useful. Thanks for the suggestion!

One conscious decision made when building this was not to blast 2FA codes inside some channel where potentially anyone can see them, which would indeed be pretty bad when users are constantly being added to your Slack workspace.

Instead, codes are fetched by explicitly using the slash command and only users who are granted access to them can see them. So if a new person joins your team and types `/tfa` into the box, they won't see anything because nobody has given them access to any codes.

Does that make sense?